A Milan court has found three Google executives guilty of criminal charges for violation of privacy following the publication of a video clip on Google Video of an Italian boy with Down’s Syndrome being beaten and insulted by other school pupils.
The Google executives were given six-month suspended jail sentences, which they will be appealing.
The video clip, which had been filmed on a mobile phone, was uploaded to Google Video in September 2006. Two months later an Italian advocacy group for people with Down’s syndrome brought a complaint to the police, who asked Google Italia to remove the clip. Google Italia argued that it removed the clip within hours of the complaint and cooperated with Italian authorities to help identify the bullies and bring them to justice.
Google said the verdict poses a crucial question for the freedom of the internet, as none of the three employees had anything to do with the video – not filming, editing or uploading it.
Google Italia faced charges for defamation, for which it was acquitted, and breach of the Italian Data Protection Code, for which it was found guilty. It was found that Google had breached Italian Data Protection Law by processing sensitive personal data, causing harm to an individual in order to profit.
This decision has potentially far-reaching consequences for service providers who host user generated content (UGC) and has highlighted one of the exceptions to the safe harbour under the E-Commerce Directive. Under the E-Commerce Directive a web host is not normally liable for videos or other content uploaded by users as long as it does not have actual knowledge of illegal activity or information and that, upon obtaining such knowledge, it acts expeditiously to remove or disable access to the information.
This protection is broadly drafted and is the basis on which web hosts such as You-Tube can function. However, there is an important carve-out: the safe harbour provisions do not apply to questions relating to data protection and there is no equivalent safe harbour under the Data Protection Directive.
In this case, although Google took prompt action and removed the video within hours of receiving the police complaint, it was not sufficient to afford it the protection of the E-Commerce safe harbour as the video invaded an individual’s privacy.
This exception has gone largely unnoticed in the UK, perhaps because the UK’s implementation of the Data Protection Directive was much weaker than Italy’s, which provides for personal liability for directors for breaches by the company. However, penalties in the UK for serious breaches of data protection legislation are becoming more serious, including fines up to £500,000 and the possibility of prison sentences is being considered.
This case places hosting providers in a difficult position. If they follow the advice of the Italian Judge and increase monitoring they are in danger of losing the protection of the E-Commerce Directive’s exemption. If they fail to monitor, they are in danger of coming up against data protection claims. Google, amongst others, will point to the near impossibility of screening every video that is posted to YouTube or similar sites and the huge cost of attempting to do so.
Until the results of the appeal come clear, it seems that the best that hosting providers can do is ensure that their policies are compliant with the data protection and privacy laws of the country in which the site is accessed and hope that the Italian appeal courts agree with the UK’s former Information Commissioner, Richard Thomas, that this case gives privacy laws a “bad name”.
Follow us online
